Add release CI: tag-triggered image publish + GitHub Release

[jcschaff]

What

Adds the missing release automation. Until now the repo had only test CI (pytest, lint/typecheck, smoke) — no workflow built or pushed images. Releases were fully manual and error-prone (the in-flight 0.5.0 backend bump was caught half-built, with overlays already pointing at images that didn't exist in the registry).

Changes

• .github/workflows/release.yaml — image publish + GitHub Release:
  • Triggers: backend-v* / frontend-v* / v* tag pushes, plus workflow_dispatch (service + version inputs).
  • plan job resolves what to build and guards that the tag version matches version.py / package.json before any build runs.
  • backend matrix builds api + worker; frontend runs npm ci && npm run build then the runtime image. amd64-only, pushed to GHCR via GITHUB_TOKEN.
  • release job cuts a GitHub Release on tag pushes (dispatch publishes images only).
• backend/scripts/bump-backend.sh — mirrors bump-frontend.sh; bumps version.py + pyproject.toml in lockstep, commits, tags backend-vX.Y.Z (removes the two-file hand-edit footgun).
• Docs — CLAUDE.md gains a Release-automation section + tag→build table; backend/CLAUDE.md Deploy steps rewritten around the tag-triggered flow; build_and_push.sh reframed as the local / multi-arch fallback.

Tag → build contract

Tag	Builds	Image tag(s)	Release
backend-vX.Y.Z	api + worker	backend-X.Y.Z	yes
frontend-vX.Y.Z	frontend	frontend-X.Y.Z	yes
vX.Y.Z	all three	both	yes
workflow_dispatch	per input	per input	no

Notes / decisions

• amd64-only in CI by decision. arm64 (e.g. biosim-local) uses the build_and_push.sh multi-arch fallback — documented in backend/CLAUDE.md.
• Deploy stays manual (kubectl apply); no kubeconfig secrets enter GitHub. RKE is on-prem and unreachable from GitHub runners.
• The actual 0.5.0 backend release (version bump + overlay repoints + tag) is a separate PR that lands after this one.

Verification

• actionlint passes clean on the new workflow (and existing ones).
• Bump-script version math + no-trailing-newline version.py rewrite tested on throwaway copies.
• Suggested first real run: workflow_dispatch with service=backend, version=0.5.0 to confirm images land in GHCR before relying on the tag path.

🤖 Generated with Claude Code